# AutoSSO 配置文件 - 仅使用阿里云
# 这是一个只使用阿里云 provider 的配置示例

# ---------------------------------------------------------------------------
# 飞书配置
# ---------------------------------------------------------------------------
feishu:
  app_id: "cli_a90a35bf9438dcda"
  app_secret: "xxx"
  approval_code: "1794B184-C6C2-418A-A4AC-65347F69727A"  # 审批流程定义代码
  chat_id: "oc_26edfdf0bdb45c1822e637c54a0d30d7"              # 飞书群聊 ID（用于通知）
  base_url: "https://open.feishu.cn"        # 飞书 API 基础 URL

  # ---------------------------------------------------------------------------
  # 表单字段映射配置 (可选)
  # ---------------------------------------------------------------------------
  # 如果不配置，将使用默认的关键词匹配规则
  # field_mappings:
  #   # 邮箱字段关键词
  #   email:
  #     - "applicant email"
  #     - "employee email"
  #
  #   # 应用类型字段关键词
  #   app_type:
  #     - "application type"
  #     - "request type"
  #
  #   # 账号字段关键词 (按云平台)
  #   account:
  #     alibaba: ["alibaba account", "alibaba cloud"]
  #     aws: ["aws account"]
  #     gcp: ["gcp project", "gcp account"]
  #     azure: ["azure subscription", "azure account"]
  #
  #   # 权限字段关键词 (按云平台)
  #   permission:
  #     alibaba: ["alibaba sso role", "alibaba role"]
  #     aws: ["aws sso role", "aws role"]
  #
  #   # 时间字段关键词
  #   start_time: ["start time", "begin time"]
  #   end_time: ["end time", "expire time"]
  #
  #   # 描述字段关键词
  #   description: ["reason", "description"]
  #
  #   # 云平台检测关键词
  #   cloud_detection:
  #     gcp: ["gcp account", "gcp project"]
  #     azure: ["azure subscription", "azure account"]
  #     alibaba: ["alibaba account", "alibaba cloud"]
  #
  #   # SSO 类型检测关键词
  #   sso_type_keywords:
  #     - "sso"
  #     - "production account application"
  #
  #   # 默认云平台类型 (未检测到时使用)
  #   default_cloud_type: "Alibaba"
  #
  #   # 自定义日期格式
  #   date_formats:
  #     - "2006-01-02T15:04:05Z07:00"
  #     - "2006-01-02"

# ---------------------------------------------------------------------------
# 数据库配置
# ---------------------------------------------------------------------------
database:
  host: "rm-2ze7p9xm1r3rc267d.mysql.rds.aliyuncs.com"       # 数据库服务器地址
  port: 3306              # 数据库端口
  user: "root"      # 数据库用户名
  password: "xxx"  # 数据库密码
  database: "security"    # 数据库名称
  max_open_conns: 10      # 最大打开连接数
  max_idle_conns: 5       # 最大空闲连接数
  max_lifetime: "1h"      # 连接最大生命周期

# ---------------------------------------------------------------------------
# 云平台 Provider 配置
# ---------------------------------------------------------------------------
providers:
  # ---------------------------------------------------------------------------
  # 阿里云配置（已启用）
  # ---------------------------------------------------------------------------
  alibaba:
    # 认证类型
    # 可选值: access_key, ecs_ram_role, ram_role_arn, oidc_role_arn
    auth_type: "ecs_ram_role"

    # 用于 access_key 认证方式
    # access_key_id: "${ALIBABA_ACCESS_KEY_ID}"
    # access_key_secret: "${ALIBABA_ACCESS_KEY_SECRET}"

    # 用于 ecs_ram_role 认证方式（推荐用于 ECS 部署）
    # auth_type: "ecs_ram_role"
    role_name: "AutoSSO-Management-Role"

    # 云 SSO 目录 ID
    # directory_id: "d-00ts1z0rjv32"  
    role_arn: "acs:ram::1901670030055339:role/autosso-test-role"
    # role_arn: "acs:ram::1082768550099546:role/autosso-management-role"

    role_session_name: "autosso-ecs-session"
    directory_id: "d-00h0edgbt347"

    # 云 SSO API 端点
    endpoint: "cloudsso.cn-shanghai.aliyuncs.com"

    # 阿里云账号列表
    accounts:
      - id: "1082768550099546"
        name: "平凯云开发账号-01(#1082768550099546)"
        type: "dev"
      # 根据需要添加更多账号
      # - id: "9876543210987654"
      #   name: "test-account"
      #   type: "test"


  # ---------------------------------------------------------------------------
  # 其他云平台（已禁用 - 未配置任何账号）
  # ---------------------------------------------------------------------------
  # AWS、GCP 和 Azure 通过不配置任何账号来禁用
  # 系统在初始化时会跳过这些 provider

  aws:
    identity_center_arn: ""
    identity_store_id: ""
    region: "ap-northeast-1"
    accounts: []  # 空列表 = 禁用此 provider

  gcp:
    credentials_file: ""
    role_mapping_file: ""
    projects: []  # 空列表 = 禁用此 provider

  azure:
    tenant_id: ""
    client_id: ""
    client_secret: ""
    subscriptions: []  # 空列表 = 禁用此 provider

# ---------------------------------------------------------------------------
# 运行时配置
# ---------------------------------------------------------------------------
runtime:
  # 检查新审批的轮询间隔
  poll_interval: "10s"

  # 检查过期权限的间隔
  expire_check_interval: "1h"

  # 自动移除过期权限前的宽限期（天数）
  grace_period_days: 3

  # HTTP 请求超时时间
  http_timeout: "10s"

  # API 调用失败时的最大重试次数
  max_retries: 3

  # 日志级别: debug, info, warn, error
  log_level: "info"

  # 是否跳过历史审批记录
  # true: 只处理程序启动后新增的审批，忽略所有历史记录
  # false: 处理最近24小时内的所有审批（默认）
  skip_historical_approvals: true

  # 豁免自动权限移除的邮箱地址列表
  whitelist_emails:
    - "admin@example.com"
    - "security@example.com"

# ---------------------------------------------------------------------------
# 权限映射配置 (Permission Mappings)
# ---------------------------------------------------------------------------
# 用于将飞书审批表单中用户看到的"选项名称" (Feishu Name) 映射为 云平台中的"真实资源名称" (Real Name)。
#
# 作用:
# 1. 解耦: 允许表单展示友好的中文名 (如 "只读权限")，而后台使用技术标识 (如 "AliyunCloudSSOReadOnlyAccess")。
# 2. 兼容: 如果表单选项值与云端名称完全一致，则无需在此配置 (但显式配置可提高可读性)。
#
# 字段说明:
# - feishu_name: 飞书审批表单中 "角色权限" 字段的选项值 (完全匹配)。
# - real_name:   对应云平台 (CloudSSO) 中的 "访问配置名称" (Access Configuration Name)。
#
permission_mappings:
  # 示例 1: 标准预置策略
  - feishu_name: "阿里云全量管理 (FullAccess)"  # 表单展示值
    real_name: "AliyunCloudSSOFullAccess"     # CloudSSO 中的名称

  # 示例 2: 只读策略
  - feishu_name: "只读权限 (ReadOnly)"
    real_name: "AliyunCloudSSOReadOnlyAccess"

  # 示例 3: 自定义策略 (支持自定义角色)
  - feishu_name: "DBA 运维权限"
    real_name: "DBA-Custom-Policy"            # 必须与 CloudSSO 中创建的访问配置名称一致

  - feishu_name: "ViewOnly-Role"
    real_name: "ViewOnly-Role"

  # 示例 4: AWS 示例 (如果启用了 AWS)
  # - feishu_name: "AWS 管理员"
  #   real_name: "AWSAdministratorAccess"